Fraudsters Buying Identities, Tips & Tricks From Black Market To File Fraudulent Colorado Unemployment Claims
(CBS4) - Unemployment fraud has been a major problem in Colorado during the pandemic - fraudsters have stolen tens of millions of dollars from our state, and thousands of people's legitimate unemployment claims are still held up on fraud holds. Now, CBS4 Investigates is getting an up-close look at how criminals across the globe have been committing unemployment fraud in the Centennial State.
Following a thorough search of various dark web forums and marketplaces, CBS4 Investigates found dumps of Coloradans' identities - called "fullz" - on the black market, advertised as the gateway to file fraudulent pandemic unemployment assistance claims.
"What's unfortunate today is that someone's identity is very likely being stored by some cyber criminal, either from one of the many data breaches that we've heard about in recent years, or things like basic phishing attacks that are all too common today," explained Crane Hassold, who previously worked for Agari, a cybersecurity company that follows the dark web closely. "The ways that cyber criminals are able to collect identity information is simply way too easy today, and so there are a lot of avenues by which that information is then sold on underground forums and dark web marketplaces."
Hassold now works for Abnormal Security, another cybersecurity company.
On one dark web marketplace, CBS4 Investigates saw an advertisement for identities from several states for sale - including Colorado. To prove the collection of identities for sale are real, the sellers show some sample identities.
One man from Pueblo is listed on the ad as an example. It shows his social security number, birthday, address, phone number, and even his mother's maiden name.
CBS4 Investigates spoke with the man on the phone. Understandably, he didn't want to be interviewed, but says within the last year, someone tried to file for unemployment in Puerto Rico with his name, and people have tried to apply for six new credit cards in his name.
Hassold has been following unemployment fraud chatter on the dark web since the beginning of the pandemic. He says a collection of about 500 identities is usually sold for only around $20.
"It's all a business, investing in certain overhead in order to try to make additional money," Hassold said. "We think about these things as as criminal activity, where most of these individuals are thinking about this is essentially their jobs, this is how they make a living, and they're just simply investing in information that could potentially make them more money in the future."
Identities aren't the only thing being traded online. Fraudsters are also sharing tips and tricks on how to best play the system.
"At this point, we've probably found tutorials for a dozen or more different states that have been circulated in various online communities about how to file unemployment claims in those states," Hassold said. "We've also found other tutorials about how to bypass different defenses that have been raised."
CBS4 Investigates also found criminals giving out advice for free.
On one dark web forum, a criminal explained how to place fraudulent job ads to collect personal information - or "fullz" - yourself to then file fraudulent unemployment claims with that information.
The forum says, "never underestimate a little social engineering or the power of stupid people on Craigslist."
"What we've seen is this Robin Hood mentality, where a lot of these cyber criminals, a lot of these scammers, are actually willingly sharing their tactics openly with other individuals, to try to increase the success rate for other people as well," Hassold said. "So, they're not sort of hoarding all of this information and then selling it to the highest bidder."
These criminals have caused big headache for thousands of Coloradans this year.
As of July 1, there were still 4,310 Coloradans who had successfully verified their identities, but their claims were still being held up on fraud holds put in place as a reaction to this criminal activity.
The Colorado Department of Labor and Employment has been working to release fraud holds "en masse" to get some relief for people, but some other holds have to be reviewed manually, which can take months, meaning months of no payment for unemployed people in our state.
In the meantime, state and federal prosecutors have been trying to crack down on the fraudsters.
"A critical reason we take this unemployment insurance fraud so seriously, is because the net impact of the amount of fraud that is being attempted here - it's staggering," said Colorado Attorney General Phil Weiser. "What's happening here is wrong, and we're going to go after these cases here in Colorado that we could prosecute."
Weiser advises all Coloradans to keep a close eye on their credit reports.
"In today's world, we preach a simple mantra, constant vigilance," Weiser said. "If you aren't checking your credit reports, and there's lots of credit cards that will give you service for free, then it could be that someone is stealing your identity, and you don't know it."
Weiser's office has created an identity theft repair kit to help you if you've been a victim of fraud.